Computer networks are well known today and comprise communication media, and routers, network switches, firewalls, authentication servers, Internet service providers, and/or load balancers. Examples of computer networks are Local Area Networks, Wide Area Networks, Intranets, the Internet, extranets, LAN, WAN, and Metro Polotan Networks. The networks interconnect client computers and server computers. The following network arrangement was known. A client computer is connected via the Internet to a network switch at a gateway to a target network. The network switch performs Network Level (or Layer) 2 switching. Network Level 2 switching is a technology that alleviates congestion in Ethernet, Token Ring and LANs (OSI layer 2) by reducing traffic and increasing bandwidth. Such switches, known as LAN switches, are designed to work with existing cable infrastructures so that they can be installed with minimal disruption of existing networks. The most common LAN media is traditional Ethernet which has a maximum bandwidth of 10 Mbps and is a half-duplex technology. Each Ethernet host checks the network to determine whether data is being transmitted before it transmits and defers transmission if the network is in use. In spite of this transmission “deferral”, two or more Ethernet hosts can transmit at the same time, which results in a collision. When a collision occurs, the hosts enter a back-off phase and retransmit later. As more hosts are added to the network, hosts must wait more often before they can begin transmitting, and collisions are more likely to occur because more hosts are trying to transmit. Today, throughput on traditional Ethernet LANs suffers even more because users are running network-intensive software, such as client-server applications, which cause hosts to transmit more often and for longer periods of time. There may be a firewall between the network switch and the target network. One or more servers are connected to the target network to provide resources (such as files, applications and services) to the client computer.
To access the resources, the user or client computer must get authenticated from an authentication function. The authentication function can reside in the target server or in a separate, authentication repository. In the latter case, one or more authentication servers can be coupled to the target network to control access to the target network. There can be one authentication server to authenticate a user of the client computer, and another authentication server to authenticate the client computer in the event there are two types of authentication that may be needed. To request logon or authentication to a resource or service in the target network, the user or client computer sends authentication or authorization information, such as a UserID and password or certificate, to the target network in a message. This message is a specific request for authentication or authorization to access the target network and includes the authentication or authorization information in the payload of the message. In the case of a request for authentication to a Windows resource, the header of the message also indicates that the message is an authentication request. Typically, the client computer parses the message into packets for network transmission. When the network switch receives message packets, it forwards them to the address indicated in the header, i.e. the target network, except if the message packet header indicates the message is an authentication request intended for a separate authentication server for the target network which is addressed. In the former case, where the message packet header does not indicate the message is an authentication request, the network switch passes the message to the firewall. The firewall then applies its security policy, and if the message complies with the security policy, the firewall forwards the message to the target server on the target network. Then, the target server attempts to authenticate the requester, and if authentic, sends a response back to the requester that the requester is authorized to access the target application. The target server keeps a record that the requester is authorized to access the target application, and the requester can send other messages requesting usage of the target application. In the latter case, where the header of the authentication request indicates that the request is for authentication, the network switch forwards the authentication request to one of the separate authentication servers. In response, the separate authentication server attempts to authenticate the requester, and if authentic, sends a response back to the requester that the requester is authorized to access the target application and also notifies the target server that the requester is authorized to access the target application. The target server keeps a record that the requester is authorized to access the target application, and the requester can send other messages requesting usage of the target application.
While the foregoing process is effective, it may require authentication functions at two or more servers.
An object of the present invention is to consolidate authentication in a single authentication function, for access to a target resource on a remote network.